             project (:project project-data)
             project-id (project-model/id project)
             project-name (vcs-url/project-name (:vcs_url project))
+            vcs-name (-> project :vcs-type utils/prettify-vcs_type)
             checkout-keys (:checkout-keys project-data)]
         (html
          [:section.checkout-page

                      :value (str "Create and add " project-name " deploy key")
                      :data-loading-text "Saving..."
                      :data-success-text "Saved"}])]])
               (when-not (some #{"github-user-key"} (map :type checkout-keys))
                 [:div.add-key
                  [:h4 "Add user key"]
                  [:p
                   "If a deploy key can't access all of your project's private dependencies, we can configure it to use an SSH key with the same level of access to GitHub repositories that you have."]
                  [:div.authorization
                   (if-not (user-model/public-key-scope? user)
                     (list
                      [:p "In order to do so, you'll need to grant authorization from GitHub to the \"admin:public_key\" scope. This will allow us to add a new authorized public key to your GitHub account."]
                      [:a.btn.ghu-authorize
                       {:href (gh-utils/auth-url :scope ["admin:public_key" "user:email" "repo"])
                        :title "Grant admin:public_key authorization so that we can add a new SSH key to your GitHub account"}
                       "Authorize w/ GitHub " [:i.fa.fa-github]])

                     [:div.request-user
                      (forms/managed-button
                       [:input.btn
                        {:tooltip "{ title: 'Create a new user key for this project, with access to all of the projects of your GitHub account.', animation: false }"
                         :type "submit"
                         :on-click #(do (raise! owner [:new-checkout-key-clicked {:project-id project-id
                                                                                  :project-name project-name
                                                                                  :key-type "github-user-key"}])
                                        false)
                         :value (str "Create and add " (:login user) " user key" )
                         :data-loading-text "Saving..."
                         :data-success-text "Saved"}])])]])

               [:div.help-block
                [:h2 "About checkout keys"]
                [:h4 "What is a deploy key?"]
                [:p "A deploy key is a repo-specific SSH key. GitHub has the public key, and we store the private key. The deployment key gives CircleCI access to a single repository."]
                [:p "If you want to push to your repository from builds, please add a user key as described below or manually add " [:a (open-ext {:href "/docs/adding-read-write-deployment-key"}) "read-write deployment key"]"."]
                [:h4 "What is a user key?"]
                [:p "A user key is a user-specific SSH key. GitHub has the public key, and we store the private key. Possession of the private key gives the ability to act as that user, for purposes of 'git' access to repositories."]
                [:h4 "How are these keys used?"]
                [:p "When we build your project, we install the private key into the .ssh directory, and configure ssh to use it when communicating with 'github.com'. Therefore, it gets used for:"]
                [:ul
                 [:li "checking out the main project"]
                 [:li "checking out any GitHub-hosted submodules"]
                 [:li "checking out any GitHub-hosted private dependencies"]
                 [:li "automatic git merging/tagging/etc."]]
                [:p]
                [:p "That's why a deploy key isn't sufficiently powerful for projects with additional private dependencies!"]
                [:h4 "What about security?"]
                [:p "The private keys of the checkout keypairs we generate never leave our systems (only the public key is transmitted to GitHub), and are safely encrypted in storage. However, since they are installed into your build containers, any code that you run in CircleCI can read them. You shouldn't push untrusted code to CircleCI!"]
                [:h4 "Isn't there a middle ground between deploy keys and user keys?"]
                [:p "Not really :("]
                [:p "Deploy keys and user keys are the only key types that GitHub supports. Deploy keys are globally unique (i.e. there's no way to make a deploy key with access to multiple repositories) and user keys have no notion of \\scope\\ separate from the user they're associated with."]
                [:p "Your best bet, for fine-grained access to more than one repo, is to create what GitHub calls a "
                 [:a {:href "https://help.github.com/articles/managing-deploy-keys#machine-users"} "machine user"]
                 ". Give this user exactly the permissions your build requires, and then associate its user key with your project on CircleCI."]]])]]])))))

(defn scope-popover-html []
  ;; nb that this is a bad idea in general, but should be ok for rarely used popovers

                 [:div
                  [:p
                   "Here are the keys we can currently use to check out your project, submodules, "
                   "and private " vcs-name " dependencies. The currently preferred key is highlighted, but "
                   "we will automatically fall back to the other keys if the preferred key is revoked."]
                  [:table.table
                   [:thead [:th "Description"] [:th "Fingerprint"] [:th]]
